aaj@ suggests that we might consider something that would "prevent executing any scripts added to the page via parser-based DOM APIs". It's not entirely clear to me how we'd best define the contours of that, but let's sketch it out and then bring it to WebAppSec for discussion.